# 不参与训练的字段
pre_handle_drop_columns = ["id", "node", "packetPos", "dangerous_deny_method", "dangerous_protocol",
                "dangerous_severity", "dangerous_threat_summary", "dangerous_traffic_type", "geo_country_iso",
                "geo_province_name", "geo_city_name", "firstPacket", "lastPacket", "dns.ip", "source.port",
                "source.ip", "destination.ip", "destination.port",
                "http.requestHeader", "http.responseHeader", "http.keyCnt", "http.key",
                "http.hostTokens", "firstPacket_datetime", "lastPacket_datetime"]
pre_handle_same_value = ['node', 'ipProtocol', 'dns.ASN', 'dns.RIR', 'dns.GEO', 'dns.alpn', 'dns.alpnCnt',
              'dns.ip', 'dns.ipCnt', 'dns.OpCode', 'dns.OpCodeCnt', 'dns.Puny', 'dns.PunyCnt', 'dns.QueryClass',
              'dns.QueryClassCnt', 'dns.QueryType', 'dns.QueryTypeCnt', 'dns.status', 'dns.hostCnt', 'dns.host',
              'dns.statusCnt', 'tls.cipher', 'tls.cipherCnt', 'tls.dstSessionId', 'tls.ja3s', 'tls.ja3sCnt',
              'tls.srcSessionId', 'tls.version', 'tls.versionCnt', 'tls.ja4_r', 'tls.ja4_rCnt', 'geo_country_iso',
              'geo_province_name', 'geo_city_name', 'dns.domain', 'entropy_dns_domain',
              'UserAgent_is_unknown']
pre_handle_high_dup_cols = ['segmentCnt',
                 'tls.ja3', 'tls.ja3Cnt',
                 'tls.ja4', 'tls.ja4Cnt', 'status_code_1x_count']

pre_handle_geo_cols = ['sip_geo_country_iso', 'sip_geo_province_name', 'sip_geo_city_name', 'dip_geo_country_iso',
            'dip_geo_province_name', 'dip_geo_city_name', 'xffip_geo_country_iso', 'xffip_geo_province_name',
            'xffip_geo_city_name']
# 训练或预测时用于排除(排除统计字段)
exclude_cols_statistic = ['network.bytes_minus_mean', 'network.bytes_z_score', 'source.bytes_minus_mean',
                  'source.bytes_z_score',
                  'destination.bytes_minus_mean', 'destination.bytes_z_score', 'totDataBytes_minus_mean',
                  'totDataBytes_z_score', 'http.requestHeaderCnt_minus_mean',
                  'http.requestHeaderCnt_z_score']
# 训练或预测时用于排除(GEO字段)
exclude_cols_geo = [
    'sip_geo_country_iso_0', 'sip_geo_country_iso_1', 'sip_geo_country_iso_2',
    'sip_geo_country_iso_3',
    'sip_geo_country_iso_4', 'sip_geo_country_iso_5', 'sip_geo_country_iso_6',
    'sip_geo_country_iso_7',
    'sip_geo_country_iso_8', 'sip_geo_country_iso_9', 'sip_geo_province_name_0',
    'sip_geo_province_name_1',
    'sip_geo_province_name_2', 'sip_geo_province_name_3', 'sip_geo_province_name_4',
    'sip_geo_province_name_5',
    'sip_geo_province_name_6', 'sip_geo_province_name_7', 'sip_geo_province_name_8',
    'sip_geo_province_name_9',
    'sip_geo_city_name_0', 'sip_geo_city_name_1', 'sip_geo_city_name_2',
    'sip_geo_city_name_3',
    'sip_geo_city_name_4', 'sip_geo_city_name_5', 'sip_geo_city_name_6',
    'sip_geo_city_name_7',
    'sip_geo_city_name_8', 'sip_geo_city_name_9', 'dip_geo_country_iso_0',
    'dip_geo_country_iso_1',
    'dip_geo_country_iso_2', 'dip_geo_country_iso_3', 'dip_geo_country_iso_4',
    'dip_geo_country_iso_5',
    'dip_geo_country_iso_6', 'dip_geo_country_iso_7', 'dip_geo_country_iso_8',
    'dip_geo_country_iso_9',
    'dip_geo_province_name_0', 'dip_geo_province_name_1', 'dip_geo_province_name_2',
    'dip_geo_province_name_3',
    'dip_geo_province_name_4', 'dip_geo_province_name_5', 'dip_geo_province_name_6',
    'dip_geo_province_name_7',
    'dip_geo_province_name_8', 'dip_geo_province_name_9', 'dip_geo_city_name_0',
    'dip_geo_city_name_1',
    'dip_geo_city_name_2', 'dip_geo_city_name_3', 'dip_geo_city_name_4',
    'dip_geo_city_name_5',
    'dip_geo_city_name_6', 'dip_geo_city_name_7', 'dip_geo_city_name_8',
    'dip_geo_city_name_9',
    'xffip_geo_country_iso_0', 'xffip_geo_country_iso_1', 'xffip_geo_country_iso_2',
    'xffip_geo_country_iso_3',
    'xffip_geo_country_iso_4', 'xffip_geo_country_iso_5', 'xffip_geo_country_iso_6',
    'xffip_geo_country_iso_7',
    'xffip_geo_country_iso_8', 'xffip_geo_country_iso_9', 'xffip_geo_province_name_0',
    'xffip_geo_province_name_1', 'xffip_geo_province_name_2', 'xffip_geo_province_name_3',
    'xffip_geo_province_name_4', 'xffip_geo_province_name_5', 'xffip_geo_province_name_6',
    'xffip_geo_province_name_7', 'xffip_geo_province_name_8', 'xffip_geo_province_name_9',
    'xffip_geo_city_name_0', 'xffip_geo_city_name_1', 'xffip_geo_city_name_2',
    'xffip_geo_city_name_3',
    'xffip_geo_city_name_4', 'xffip_geo_city_name_5', 'xffip_geo_city_name_6',
    'xffip_geo_city_name_7',
    'xffip_geo_city_name_8', 'xffip_geo_city_name_9']
